文章目录
- 1 范围
- 2 参考
- 3 定义和缩略语
- 4 General
- 4.1 概述
- 4.2 EMM和ESM协议之间的连接
- 4.2A NAS信令低优先级指示的处理
- 4.3 UE mode of operation UE的操作模式
- 4.4 NAS security
- 4.5 Disabling and re-enabling of UE's E-UTRA capability
- 4.6 Applicability of procedures
- 5 Elementary procedures for EPS mobility management
- 5.1 Overview
- 5.1.1 General
- 5.1.2 Types of EMM procedures
- 5.1.3 EMM sublayer states
- 6 Elementary procedures for EPS session management
- 6.1 Overview
- 6.2 IP address allocation
- 6.3 General on elementary ESM procedures
- 6.4 Network initiated ESM procedures
- 6.5 UE requested ESM procedures
- 7 Handling of unknown, unforeseen, and erroneous protocol data
- 8 Message functional definitions and contents
- 9 General message format and information elements coding
- 10 List of system parameters
Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 (Release 8)
1 范围
当前这篇文档是EPS系统总UE和MME之间移动性管理和会话管理协议相关的过程描述。这些协议都属于NAS层。
EMM协议为使用E-UTRAN的UE提供了移动控制过程。同样也为NAS协议提供安全控制。
ESM协议提供了处理EPS承载上下文的过程。和ASA层提供的承载控制一起,ESM协议也用作用户面承载的控制。
对于NAS协议,本篇文档也描述了在E-UTRAN和其他3GPP或者non-3GPP之间的系统间移动性过程:
对于E-UTRAN和GERAN或者UTRAN系统间移动性,包含了本文档中叙述的NAS协议使用的参数/过程和3GPP TS 24.008 [13]中描述的NAS协议之间的映射规则。
对于E-UTRAN和non-3GPP接入网络,包含了连接PDN网关维持IP连接的NAS过程和当双栈手机IPv6(see 3GPP TS 24.303 [14]) 或者 MIPv4 (see 3GPP TS 24.304 [15])使用移动性管理需要UE提供参数的NAS过程。
当前文档是对EPS中的UE和MME都是有效的。
当前文档中EPS中的中继节点(see 3GPP TS 23.401 [10])也是有效的。
2 参考
…
3 定义和缩略语
…
4 General
- 4.1 overview
- 4.2 EMM和ESM协议之间的连接
- 4.3 UE mode of operation
- 4.4 NAS security
4.1 概述
当前文档中描述的NAS层是UE和MME之间无线接口的控制面的最高层。(reference point “LTE-Uu”; see 3GPP TS 23.401 [10]).
这部分NAS协议的主要功能是:
- UE移动性的支持
- 在UE和PDN GW之间建立和维持IP连接的会话管理提供支持
NAS安全也是NAS层提供的一个功能,eg,NAS信令消息的完整性保护和加密。
对于上述功能的支持,本文档将提供下面的过程:
- 在第五章EMM的基本过程
- 在第六章ESM的基本过程
完整的NAS传输包含基本过程的特定组合。这些特定组合的实例参照3GPP TS 23.401 [10]。
EPS的NAS遵守3GPP TS 24.007 [12]中的层3协议架构。但是因为EPS提供给用户"ready-to-use"的IP连接和"always-on"的体验,在attach过程时EMM和ESM过程之间有一些连接(see subclause 4.2)。
关于NAS安全控制的信令过程将在第五章作为EMM的一部分叙述。另外,当NAS信令连接建立时,包含处理EPS安全上下文和加密/完整性保护激活的原理将会在4.4章节叙述。
4.2 EMM和ESM协议之间的连接
在EPS attach过程中,网络激活默认EPS承载上下文。另外,网络能同时激活一个或者几个专用EPS承载上下文。为了这种目的,默认EPS承载上下文激活的ESM消息作为一个信息单元包含在ESM消息中发送。UE和网络并行执行attach过程,默认EPS承载上下文激活过程,和专用EPS承载上下文激活过程。UE和网络应该在专用EPS承载上下文完成之前完成默认EPS承载上下文激活过程和attach过程。attach的过程成功与否取决于默认EPS承载上下文激活过程的成功与否。如果attach过程失败,ESM过程也失败。
除了attach过程和service request过程,在EMM过程中,MME应该暂停ESM消息的传输。在service request过程中个,MME可能(may)也会暂停ESM消息的传输。
除了attach过程,在EMM过程中,UE应该暂停ESM消息的传输。
4.2A NAS信令低优先级指示的处理
注:NAS信令低优先级(see 3GPP TS 24.368 [15A], 3GPP TS 31.102 [17])
配置为NAS信令低优先级的UE除了下面的几种情况中UE需要设置low priority indicator 为 "MS is not configured for NAS signalling low priority"之外,UE应该在相应的NAS消息中包含Device properties IE并设置low priority indicator 为 “MS is configured for NAS signalling low priority”:
- UE正在执行emergency bearer services的attach;
- UE有emergency bearer services的PDN连接,并且正在执行EMM过程,或者正在为emergency bearer services建立PDN连接;
- 配置了双优先级的UE已经被上层以low priority indicator 为 "MS is not configured for NAS signalling low priority"的请求建立PDN连接;
- 配置为双优先级的UE已经有一个通过设置low priority indicator 为 "MS is not configured for NAS signalling low priority"的PDN连接建立了,并且正在执行EMM过程;
- UE在选择的PLMN上配置使用了AC11 – 15接入优先级;或者
- UE正在响应寻呼。
网络可以(may)使用NAS信令低优先级指示用于NAS层移动性管理拥塞控制和基于APN的拥塞控制。
如果NAS信令低优先级指示在PDN CONNECTIVITY REQUEST消息中提供,MME把NAS信令低优先级指示包含在默认EPS承载上下文中。
4.3 UE mode of operation UE的操作模式
- 4.3.1 General
- 4.3.2 Change of UE mode of operation
4.3.1 General
attach上EPS服务的UE应该是下面的集中操作模式之一:
- PS mode 1:UE仅仅注册EPS服务,UE usage setting设置为voice centric;
- PS mode 2:UE仅仅注册EPS服务,UE usage setting设置为data centric;
- CS/PS mode 1:UE注册在EPS和non-PES服务,UE usage setting设置为voice centric;
- CS/PS mode 2:UE注册在EPS和non-EPS服务,UE usage setting设置为data centric。
**配置使用CSFB的UE应该是CS/PS mode 1或者CS/PS mode 2。**这样的UE也可能被配置使用IMS,在这种情况下,发起语音通话应该优先使用vocie domain(3GPP TS24.167)。
note1:作为发起语音通信服务选择的这个域可以通过尝试CS紧急通话来忽略。
一旦有上层的请求来建立CS紧急通话:
- 如果UE需要发起CSFB紧急通话,但是UE不能执行CSFB,UE将会尝试选择到GERAN或者UTRAN,并且具有“IMS voice not available”的UE应该disable E-UTRAN能力来允许可能的CSFB,并且接着进行CS紧急通话建立。
- 如果UE能发起1xCSFB紧急通话,但是不能执行1xCSFB,UE应该尝试选择到cdma2000 1x来建立通话这个通话。
note2:不能执行CSFB或者1xCSFB紧急通话意味着UE不允许尝试CSFB/1xCSFB,或者CSFB/1xCSFB尝试失败。
配置使用SMS over SGS的UE应该是CS/PS mode 1或者CS/PS mode 2.
CS/PS mode 1的UE一旦CS域接入失败或者接收到“CS fallback not prefered”/“SMS only”indication,将根据IMS上voice的可用性来决定UE行为。在当前文档中,**“IMS voice not available”**是指下面条件之一:
a) UE没有配置使用IMS
b) UE没有配置使用IMS voice,i.e.当在E-UTRAN中voice domain preference,(定义在3GPP TS 24.167 [13B]),表示语音通话服务只允许通过CS域来获得。
c) UE配置使用IMS voice,但是网络在ATTACH ACCEPT消息中或者TRACKING AREA UPDATE ACCEPT消息中指示不支持通过PS会话的IMS voice。
d) UE配置使用IMS voice,网络在ATTACH ACCEPT消息中或者TRACKING AREA UPDATE ACCEPT消息中指示支持通过PS会话的IMS voice,但是上层
- 在厂家决定的一段时间周期内,上层没有提供指示说UE在IMS上语音通话是可用的,或者
- 上层指示UE在IMS上语音通话不可用。
Note3:如果条件a,b,c都是false,上层需要时间来尝试IMS注册。UE在IMS上语音通话是可用的这个来自上层的指示事件比厂商决定时间周期要长,NAS层假设UE在IMS上是不能语音通话的。(eg. 当试图IMS注册导致的延迟或者因为为了SIP信令获得EPS承载上下文导致的延迟)。
其他条件可能存在,但是这些取决于实现。
4.3.2 Change of UE mode of operation
- 4.3.2.1 General
- 4.3.2.2 Change of UE’s usage setting
- 4.3.2.3 Change of voice domain preference for E-UTRAN
- 4.3.2.4 Change or determination of IMS registration status
- 4.3.2.5 Change of configuration regarding the use of SMS
4.3.2.1 General
UE操作模式可以由于以下原因变化:eg
- 对于具有CS语音能力的UE,UE usage setting的变化;
- 对于具有CS语音能力的UE,E-UTRAN voice domain preference的变化,(see 3GPP TS 24.167 [13B])
- UE能否在IMS上语音通话可用性的变化
- 关于SMS使用配置的变化,(see 3GPP TS 24.167 [13B])
图4.3.2.1.1和图4.3.2.1.2描述了当UE usage setting,E-UTRAN voice domain preference或者关于SMS配置改变时不同UE操作模式的变化。
![3GPP TS 24.301 Release 8 中文版_第1张图片](http://img.e-com-net.com/image/info8/a3bc167303304243a3de063ebc26172b.jpg)
![3GPP TS 24.301 Release 8 中文版_第2张图片](http://img.e-com-net.com/image/info8/71d889ad002a4dbb97f35d6807a1c576.jpg)
![3GPP TS 24.301 Release 8 中文版_第3张图片](http://img.e-com-net.com/image/info8/6f7b29cbe1c74773b44d5229637fffdd.jpg)
![3GPP TS 24.301 Release 8 中文版_第4张图片](http://img.e-com-net.com/image/info8/95bdd2b55c7b471389e10ef2812fbb0b.jpg)
![这里写图片描述](http://img.e-com-net.com/image/info8/84a37bf5d888433489c8b536704ad3a5.jpg)
4.3.2.2 Change of UE’s usage setting
只要当UE的usage setting变化,UE根据操作模式依照 table 4.3.2.2.1 and table 4.3.2.2.2来执行相应的过程。
a) UE在PS mode 1或者PS mode 2
![3GPP TS 24.301 Release 8 中文版_第5张图片](http://img.e-com-net.com/image/info8/5430077e626044b9858da62ed8e6292f.jpg)
b) UE在CS/PS mode 1或者CS/PS mode 2
![3GPP TS 24.301 Release 8 中文版_第6张图片](http://img.e-com-net.com/image/info8/5aba1ab762764e1e90affdf809b965a2.jpg)
4.3.2.3 Change of voice domain preference for E-UTRAN
只要当UE的E-UTRAN voice domain preference变化,UE根据操作模式依照 table 4.3.2.3.1 and table 4.3.2.3.2来执行相应的过程。
a) UE在PS mode 1或者PS mode 2
![3GPP TS 24.301 Release 8 中文版_第7张图片](http://img.e-com-net.com/image/info8/3c53903341824abea6cce23c4ae395f8.jpg)
b) UE在CS/PS mode 1或者CS/PS mode 2
![3GPP TS 24.301 Release 8 中文版_第8张图片](http://img.e-com-net.com/image/info8/8a05b713db454e7a986e63cc0ae05b7a.jpg)
4.3.2.4 Change or determination of IMS registration status
只要当UE在IMS上语音通话可用性的变化(eg,只要IMS注册状态发生变化),UE会根据操作模式依照table 4.3.2.4.1 and table 4.3.2.4.2来执行相应的动作。
a) UE在PS mode 1
![3GPP TS 24.301 Release 8 中文版_第9张图片](http://img.e-com-net.com/image/info8/37ea5a602fea4cca861dc5689b339952.jpg)
b) UE在PS mode 2
![3GPP TS 24.301 Release 8 中文版_第10张图片](http://img.e-com-net.com/image/info8/90ae7cc9d2cb493996f8e2ef1512489b.jpg)
4.3.2.5 Change of configuration regarding the use of SMS.
只要当UE的关于SMS的配置发生变化,UE根据操作模式依照table 4.3.2.5.1 and table 4.3.2.5.2来执行相应的过程。
a) UE在PS mode 1或者PS mode 2
![3GPP TS 24.301 Release 8 中文版_第11张图片](http://img.e-com-net.com/image/info8/1f00738b5a82486e9b79fa5dc6d6f893.jpg)
b) UE在CS/PS mode 1或者CS/PS mode 2
![3GPP TS 24.301 Release 8 中文版_第12张图片](http://img.e-com-net.com/image/info8/de8335684a3f494190c693d5607edfcb.jpg)
4.4 NAS security
4.4.1 一般
本节描述了在UE和MME EPS安全上下文和用于UE和MME之间的EPS NAS消息的安全保护程序的处理原则。安全保护涉及的EMM和ESM NAS消息的完整性保护和加密。
对于NAS安全的控制信令程序是EMM协议的一部分,细节在第5条中描述。
注:在网络上使用加密的是运营商的选择。在本节中,对于便于描述,假设加密时使用的,除非明确地另有说明。未经加密的网络的操作是由MME配置的,它始终选择了“空的加密算法”EEA0实现。
4.2.2 EPS安全上下文的处理
- 4.2.2.1 General
- 4.4.2.2 Establishment of a mapped EPS security context during intersystem handover
- 4.4.2.3 Establishment of secure exchange of NAS messages
- 4.4.2.4 Change of security keys
- 4.4.2.5 Derivation of keys at CS to PS SRVCC handover from A/Gb mode to S1 mode or from Iu mode to S1 mode
4.2.2.1 General
鉴权,完整性保护和加密的安全参数是和EPS安全上下文联系在一起的,并在使用一个秘钥集标识eKSI来标识。这些安全上下文之间的关系定义在3GPP TS 33.401 [19]。
在安全激活之前,MME和UE需要建立EPS安全上下文。通常,EPS安全上下文是作为MME和UE之间EPS鉴权过程的结果而创建的。EPS安全上下文是下面两种方式之一:
- 在从A/Gb mode到S1 mode或者从Iu mode到S1 mode的异系统切换时,MME和UE从A/Gb mode或者Iu mode已经建立的UMTS安全上下文生成一个映射的EPS安全上文(mapped),或者
- 在从A/Gb mode到S1 mode或者从Iu mode到S1 mode的CS到PS SRVCC切换时,MME和UE从A/Gb mode或者Iu mode已经建立的CS UMTS安全上下文来生成一个映射的EPS安全上下文(mapped)。
当MME发起Security Mode Control过程或者从A/Gb mode到S1 mode或者从Iu mode到S1 mode的异系统切换时,UE和MME开始使用EPS安全上下文。这个被网络投入使用的最近的EPS安全上文叫做current EPS安全上下文。current EPS安全上下文可以是native类型或者mapped类型。
秘钥集标识eKSI是在EPS鉴权过程或者在异系统切换过程(作为mapped EPS安全上下文)由MME分配的。eKSI包含安全上下文的类型用来指示这个EPS安全上文是一个native 还是 mapped。当EPS安全上下文是一个native时,eKSI是KSI-ASME,当当前EPS安全上下文是mapped类型的时,eKSI是KSI-SGSN。
当没有执行新的EPS鉴权过程的新NAS信令连接建立时或者当MME发起Security Mode Control过程时,eKSI标识的EPS安全上下文开始用于建立NAS消息的安全交换。为了这个目的,初始NAS消息((i.e. ATTACH REQUEST, TRACKING AREA UPDATE REQUEST, DETACH REQUEST, SERVICE REQUEST and EXTENDED SERVICE REQUEST))和SECURITY MODE COMMAND消息在NAS key set identifier IE或者KSI的eKSI值部分包含一个eKSI,和sequence number IE标识current EPS安全上下文用来对NAS消息完整性保护。
在当前文档中,当UE需要删除eKSI,UE需要设置eKSI的值为"no key is available",并且认为与其相关联的KASME or K’ASME, EPS NAS ciphering key 和EPS NAS integrity key无效(i.e.和eKSI相关的EPS安全上下文不在有效)。
Note:在一些规范中,可能使用加密秘钥序列号代替秘钥集标识eKSI。
UE和MME需要同时保持两个EPS安全上下文,也就是说,current EPS安全上下文和non-current EPS安全上下文,因为:
- 在EPS重新鉴权后,UE和MME都有一个current EPS安全上下文和non-current EPS安全上下文(还没有投入使用的,也就是partial nativeEPS安全上下文);
- 在从A/Gb mode到S1 mode或者从Iu mode到S1 mode的异系统切换后,UE和MME都有一个mapped EPS安全上下文(这个mapped上下文是current EPS安全上下文)和一个non-current native EPS安全上下文(这个上下文是在之前接入S1 mode或者S101 mode时创建的)。
需要由UE和MME同时保持的EPS安全上下文的数量是受到下面因素限制的:
- 在成功EPS(重新)鉴权后,创建了新的partial native EPS安全上下文,MME和UE可以删除non-current EPS安全上下文了。
- 当partial native EPS安全上下文通过security mode control 过程投入使用时,MME和UE可以删除之前的current EPS安全上下文。
- 当MME和UE在emergency bearer service的attach过程或者UE已经有emergency bearer service的PDN连接的TAU过程中使用null integrity和null ciphering算法来建立EPS安全上下文时,MME和UE可以删除之前的current EPS安全上下文。
- 当一个新的mapped EPS安全上下文或者EPS安全上下文在从A/Gb mode到S1 mode或者从Iu mode到S1 mode的异系统切换中使用null integrity和null ciphering算法来投入使用时,MME和UE不应该删除之前的current native EPS安全上下文,MME和UE应该删除任何partial native EPS安全上下文。
如果没有之前的current native EPS安全上下文存在,MME和UE不应该删除partial native EPS安全上下文。
- 当MME和UE在从A/Gb mode到S1 mode或者从Iu mode到S1 mode的异系统切换产生一个新的mapped EPS安全上下文,MME和UE应该删除任何存在的current mapped EPS安全上下文。
- 当通过security mode control过程一个non-current full native EPS安全上下文投入使用时,MME和UE应该删除之前的current mapped EPS安全上下文。
- 当UE或者MME从EMM-REGISTERED转移到EMM-DEREGISTERED状态时,如果current EPS安全上下文是mapped EPS安全上下文和non-current full native EPS安全上下文存在,接着non-current EPS安全上下文应该成为current EPS安全上下文。此外,UE和MME应该删除任何mapped EPS安全上下文或者partial native EPS安全上下文。
当UE从除了EMM-NULL状态之外的其他状态进入到EMM-DEREGISTERED状态时,或者当UE中断attach过程没有离开EMM-DEREGISTERED状态时,UE应该在USIM上或者在非易失性存储器上标记EPS安全上下文为无效。
4.4.2.2 Establishment of a mapped EPS security context during intersystem handover
为了在UE从A/Gb mode到S1 mode或者从Iu mode到S1 mode的异系统切换生成mapped EPS安全上下文,MME应该生成一个KSI-SGSN,创建一个nonce-MME,并使用nonce-MME和KSI-SGSN生成K’ASME,(see 3GPP TS 33.401 [19])。MME应该在切换到E-UTRAN的NAS安全透传数据包中包含选择的NAS算法、nonce-MME、KSI-SGSN。MME应该从K’ASME生成EPS NAS秘钥。
KSI-SGSN+nonce-MME===》K’ASME===》EPS NAS Keys
当UE收到执行切换到E-UTRAN的命令时,UE使用NAS安全透传数据包中接收到的nonce-MME生成K’ASME(see 3GPP TS 33.401 [19])。此外,UE应该使用接收到的KSI-SGSN生成K’ASME,并从K’ASME生成EPS NAS秘钥。
KSI-SGSN(from MME)+nonce-MME(from MME)=》K’ASME=》EPS NAS Keys
当UE有一个emergency bearer service的PDN连接,并且没有current UMTS安全上下文,MME应该在切换到E-UTRAN的NAS安全透传数据包中设置EIA0和EEA0作为NAS选择的算法。MME应该创建一个本地生成的K’ASME。MME在切换到E-UTRAN的NAS安全透传数据包中设置相关联安全上下文的KSI值为“000”,并设置安全上下文标志类型为"mapped security context"。
当UE收到切换到E-UTRAN的命令时,并且有emergency bearer service的PDN连接时,如果在切换到E-UTRAN的NAS安全透传数据包中选择EIA0和EEA0作为NAS安全算法,UE应该创建本地生成的K’ASME。UE应该把相关联安全上下文的KSI值设置为接收到的KSI值。
如果从A/Gb mode到S1 mode或者从Iu mode到S1 mode的异系统切换在EMM-CONNECTED状态没有成功完成,MME和UE应该删除新的mapped EPS安全上下文。
4.4.2.3 Establishment of secure exchange of NAS messages
通过NAS信令连接的NAS消息的安全交换是通过在attach过程中发起security mode command过程由MME建立的。在成功完成security mode command过程之后,UE和MME之间所有交换的NAS消息都使用current EPS安全算法来完整性保护,并且除了subclause 4.4.5指定的消息除外,UE和MME之间所有交换的NAS消息都是使用current EPS 安全算法加密的。
在从A/Gb mode到S1 mode或者从Iu mode到S1 mode的异系统切换过程中,MME和UE之间的NAS消息的安全交换是通过:
- 通过包裹在从MME到UE触发异系统切换的AS信令中的NAS安全相关参数的发送来实现的。UE使用这些参数来生成mapped EPS安全上下文。
- 在切换后,通过从UE到MME的TAU过程的发送来实现。UE应该发送使用mapped EPS安全上下文完整性保护但是没有加密的TAU消息。从这个时间点往前,UE和MME之间交换的所有NAS消息都是使用mapped EPS安全上下文完整性保护的,并且除了subclause 4.4.5指定的消息除外,UE和MME之间所有交换的NAS消息都是使用mapped EPS 安全算法加密的。
在S1mode到S1 mode的切换之后,NAS消息的安全交换应该继续。在S1 mode到A/Gb mode 或Iu mode的异系统切换时,或者当NAS连接释放时,NAS消息的安全交换才会终止。
当EMM-IDLE模式的UE建立一个新NAS信令连接并且有一个有效的current EPS安全上下文,NAS消息的安全交换应该根据以下方式进行重建:
- 除了在下面case3描述的之外,UE应该发送使用current EPS安全上下文完整性保护但是没有加密的initial NAS消息。UE应该包含eKSI指示initial NAS消息中的current EPS安全上下文的值。MME应该检查包含在initial NAS消息中的eKSI是否属于MME中一个可用的EPS安全上下文,并且应该验证这个NAS消息的MAC。如果验证成功,MME可能(may)重建NAS消息的安全交换:
- 通过回复一个使用current EPS安全上下文完整性保护和加密的NAS消息来完成重建。从这个时间点开始,UE和MME之间的所有交换的NAS消息都是完整性保护的,并且除了subclause 4.4.5指定的消息除外,UE和MME之间所有交换的NAS消息都是加密的。或者
- 通过发起security mode command过程来完成重建。这可以使MME把一个non-current EPS安全上下文投入使用,或者通过选择一个新的NAS安全算法修改current EPS安全上下文。
- 如果initial NAS消息是SERVICE REQUEST消息或者EXTENDED SERVICE REQUEST消息,NAS消息的安全交换被来自底层的用户面无线承载已经成功建立的指示所触发。在成功完成这个过程后,UE和MME之间的所有NAS消息的交换都是完整性保护的,并且除了subclause 4.4.5指定的消息除外,UE和MME之间所有交换的NAS消息都是加密的。
- 如果UE没有current EPS安全上下文,并且在从A/Gb mode到S1 mode或者从Iu mode到S1 mode的异系统切换后执行TAU过程,UE应该发送没有完整性保护和加密的TAU消息。UE应该包含nonce和GPRS加密秘钥序列号来创建mapped EPS安全上下文。MME创建一个新的mapped EPS安全上下文并且通过发起security mode command过程把这个上下文投入使用,并且在UE和MME中这个上下文变成current EPS安全上下文。这样就冲建立NAS消息的安全交换。
4.4.2.4 Change of security keys
当MME发起重新鉴权来常见一个新的EPS安全上下文时,鉴权过程中交换的消息是使用current EPS安全上下文来完整性保护和加密的。
UE和MME应该持续使用current EPS安全上下文直到MME发起security mode command过程。MME发送的SECURITY MODE COMMAND消息包含要使用的新EPS安全上下文的eKSI。么应该发送使用新EPS安全上下文完整性保护但是没有加密的SECURITY MODE COMMAND消息。当UE响应SECURITY MODE COMMAND消息时,UE应该使用新EPS安全上下文完整性保护和加密的这个消息。
MME也可能通过SECURITY MODE COMMAND消息(包含要修改的这个EPS安全上下文的eKSI和包含选择的新NAS安全算法集合)来修改current EPS安全上下文,或者把non-current EPS 安全上下文投入使用。这种情况下,MME应该使用修改过的EPS安全上下文完整性保护但是没有加密的SECURITY MODE COMMAN发送。当UE使用SECURITY MODE COMPLETE消息响应,UE应该使用修改过的EPS安全上下文完整性保护和加密这个消息。
4.4.2.5 Derivation of keys at CS to PS SRVCC handover from A/Gb mode to S1 mode or from Iu mode to S1 mode
在从A/Gb mode到S1 mode或者从Iu mode到S1 mode因为CS到PS SRVCC切换时(see 3GPP TS 23.216 [8]),UE应该为PS域从CS域的UMTS安全上下文生成一个mapped EPS安全上下文。
在从A/Gb mode到S1 mode因为CS到PS SRVCC切换时,在没有任何新的鉴权过程时,加密可能(may)会开始,完整性保护应该(should)开始。
note 1:如果current EPS安全上下文是一个GSM安全上下文,则从A/Gb mode到S1 mode或者从Iu mode到S1 mode因为CS到PS SRVCC切换不支持。
Note 2:对于紧急通话,从A/Gb mode或者从Iu mode到S1 mode的CS到PS SRVCC切换是不支持的。
(网络端行为)
对于从A/Gb mode或者从Iu mode到S1 mode的CS到PS SRVCC切换,为了生成一个mapped EPS安全上下文,MSC创建NONCE-MSC,并使用CS UMTS完整性秘钥/CS UMTS加密秘钥/创建的NONCE-MSC生成CK’PS 和IK’PS(specified in annex B.6 in 3GPP TS 33.102 [18])。MSC使用KSI’PS把CK’PS 和IK’PS联系起来。KSI’PS设置为和CS UMTS完整性秘钥和CS UMTS加密秘钥相关联的KSI’PS的值。MSC传输CK’PS, IK’PS和KSI’PS给MME。MME通过设置K’AMSE为从MSC接收到的CK’PS和IK’PS两个的级联 (i.e. CK’PS || IK’PS)来创建一个mapped EPS安全上下文。MME应该使用KSISGSN来关联K’ASME,MME应该设置KSISGSN 为从MSC接收到的KSI’PS。MME应该切换到E-UTRAN的NAS透传数据包中包含NAS算法,NONCEMME和生成的KSISGSN (和K’ASME相关联) 。MME应该从K’ASME生成EPS NAS秘钥。
(UE端行为)
当收到执行CS到PS SRVCC切换S1 mode的命令时,ME应该使用CS UMTS integrity key, the CS UMTS ciphering key和从CS to PS SRVCC切换命令中的接收到的NONCEMSC(specified in annex B.6 in 3GPP TS 33.102 [18])。ME应该忽略从CS to PS SRVCC切换命令中的接收到的NONCEMME。
NOTE 3: 在切换到E-UTRAN过程中NAS安全透传数据包中接收到的NONCEMME不在这次切换和任何秘钥生成中被ME或者MME使用。
ME应该通过级联CK’PS 和 IK’PS (i.e. CK’PS || IK’PS.)来创建K’ASME,ME应该使用KSISGSN关联生成的秘钥K’ASME。ME应该设置KSISGSN值(和K’ASME关联)为从网络NAS安全透传数据包中接收到的KSISGSN值。
NOTE 4: 尽管这种情况是和SRVCC的MSC server增强有关,但是名字KSISGSN保持不变,以免在同一个域中引入一个新的名字。
(UE端行为)
ME应该从K’ASME中生成EPS NAS秘钥(CK’ and IK’)(specified in 3GPP TS 33.401 [19])。当从A/Gb mode 或者 Iu mode到S1 mode的CS to PS SRVCC成功完成切换时,ME应该应用这些生成的EPS NAS安全秘钥(CK’ and IK’),并重置mapped EPS安全上下文中上下行NAS COUNT的值(ie set to 0),并且代替在ME中已经为PS域建立的mapped EPS安全上下文。如果已经建立的current EPS 安全上下文是native类型的,那么current EPS安全上下文将变成non-current native EPS安全上下文,并在ME中重写任何存在的non-current native EPS安全上下文。
(网络端行为)
当从A/Gb mode 或者 Iu mode到S1 mode的CS to PS SRVCC成功完成切换时,网络应该代替已经为PS域建立的mapped EPS安全上下文。如果已经建立的current EPS 安全上下文是native类型的,那么current EPS安全上下文将变成non-current native EPS安全上下文,并在MME中重写任何存在的non-current native EPS安全上下文。
(没有切换成功的情况)
如果从A/Gb mode 或者 Iu mode到S1 mode的CS to PS SRVCC切换还没有成功完成,UE和网络应该删除为PS域新生成的mapped EPS安全上下文。另外,如果已经建立的EPS安全上下文的eKSI等于为PS域新生成的EPS安全上下文的KSI-SGSN,则网络应该删除已经为PS域建立的mapped EPS安全上下文。
4.4.3 Handling of NAS COUNT and NAS sequence number
- 4.4.3.1 General
- 4.4.3.2 Replay protection
- 4.4.3.3 Integrity protection and verification
- 4.4.3.4 Ciphering and deciphering
- 4.4.3.5 NAS COUNT wrap around
4.4.3.1 General
每一个EPS NAS安全上下文应该和两个独立的计数器NAS COUNT:一个是上行NAS消息的,一个是下行NAS消息的。这个NAS COUNT使用24bit表示,并且在UE和MME中独立的保持。这个NAS COUNT是由NAS序列号(8个最低位重要的bit)和NAS溢出计数器(16个最高位中重要的bit)。
当NAS COUNT输入到NAS加密或者NAS完整性算法中,应该认为是由24bit后面加上8bit的zeros组成的32bit。
上行NAS COUNT的值被存储在或者从USIM/非易失性存储器上读出(see 附录C),这个值应该应用在下次NAS消息中。
下行NAS COUNT的值被存储在或者从USIM/非易失性存储器上读出(see 附录C),这个值是最大的下行NAS COUNT使用在成功完整性检查NAS消息。
NAS COUNT的NAS序列号部分应该作为NAS信令的一部分在UE和MME之间交换。在每一个新的或者重传的发出去的安全保护的NAS消息后,发送端都应该把NAS COUNT值加一,除了如果底层指示建立RRC连接失败时的初始NAS消息。特别的,在发送端,NAS序列号也应该加一,如果这个结果是0,NAS溢出计数器应该加一(see subclause 4.4.3.5)。接收端应该估算发送端使用的NAS COUNT值。特别的,如果估计的NAS序列号翻转了,NAS应该加一。
因为idle模式下从S1 mode to A/Gb mode or Iu mode系统间切换在NAS token派生出来之后,UE应该把上行NAS COUNT加一。
当MME在idle模式下从S1 mode to A/Gb mode or Iu mode系统间切换时通过SGSN接收到NAS token时,MME应该检查这个NAS token(specified in 3GPP TS 33.401 [19])subclause 9.1.1,并且使用成功NAS token成功检查的上行NAS COUNT来更新上行NAS COUNT。
NOTE1:如果MME在connected模式下从S1 mode to A/Gb mode or Iu mode系统间切换时通过SGSN接收的,MME不会检查NAS token。
在从UTRAN/GERAN 到E-UTRAN切换过程中,当生成一个mapped EPS安全上下文并投入使用,MME应该设置这个EPS安全上下文的上下行NAS COUNT为0. UE应该也设置上下行NAS COUNT为0.
在从E-UTRAN 到UTRAN/GERAN切换中,MME在NAS安全透传数据包中设置当前下行NAS COUNT值。 (see subclause 9.9.2.6).
在切换到E-UTRAN/从E-UTRAN切换中,MME应该在创建NAS安全透传数据包之后把下行NAS COUNT值加一。 (see subclause 9.9.2.6 and 9.9.2.7).
NOTE2:在从UTRAN/GERAN 到E-UTRAN切换中,NAS安全透传数据包被视为UE和MME之间一个内含的(implicit)SECURITY MODE COMMAND消息,然而,MME认为这个发送的NAS安全透传数据包作为初始SECURITY MODE COMMAND消息的发送来为了生成并投入使用一个mapped EPS安全上下文来处理NAS COUNT。
在一些NAS消息中,只有8bit NAS序列号中的5bit用于传输。在这种情况下,接收端应该评估序列号中保留的3位最重要的bit。
4.4.3.2 Replay protection
replay protection应该在UE和MME端接收NAS消息来应用。但是,因为replay protection的实现不影响节点之间的互用性,对于实现没有指定的机制。
replay protection必须确保一个和同一个NAS消息不能被接收端接收两次。特别的,对于给定的NAS安全上下文,一个给定的NAS COUNT值应该最多一次和仅仅在消息完整性检查正确通过时才能被接收。
4.4.3.3 Integrity protection and verification
发送端应该使用它贝蒂存储的NAS COUNT作为完整性保护算法的输入。
接收端应该使用包含在接收消息中的NAS序列号(或者是接收消息中NAS序列号5bit的估计中得到)和NAS溢出计数器(defined in subclause 4.4.3.1)来形成完整性保护验证算法的NAS COUNT输入值。
计算完整性保护信息的算法定义在3GPP TS 33.401 [19],完整性保护应该包含安全保护的NAS消息中的octet 6 to n,也就是说sequence number IE和NAS message IE。SERVICE REQUEST消息的完整性保护定义在subclause 9.9.3.28.。除了要完整性保护的数据之外,常数BEARER ID,DIRECTION bit, NAS COUNT and NAS integrity key都是完整性保护算法的输入。这些参数在3GPP TS 33.401 [19].中描述。
在成功完整性保护验证之后,接收到应该使用这个NAS消息中的估计的NAS COUNT来更新响应的本地存储的NAS COUNT。
完整性验证不适用于EIA0没有使用的情况。
4.4.3.4 Ciphering and deciphering
发送端应该使用本地存储的NAS COUNT作为加密算法的输入。
接收端应该使用包含在接收消息中的NAS序列号(或者是接收消息中NAS序列号5bit的估计中得到)和NAS溢出计数器(defined in subclause 4.4.3.1)来形成解密算法的NAS COUNT输入值。
NAS加密算法的输入参数有常数BEARER ID, DIRECTION bit, NAS COUNT, NAS encryption key和加密算法生成的加密数据流的长度。
4.4.3.5 NAS COUNT wrap around
当如上面的规范指定的增加NAS COUNT,如果MME检测到MME的下行NAS COUNT后者UE的上行NAS COUNT是接近wrap around(close to 224),MME应该采取以下动作:
- If there is no non-current native EPS security context with sufficiently low NAS COUNT values, 如果没有低 NAS COUNT值的non-crrent EPS安全上下文,当新NAS安全上下文发起时,MME应该发起新的AKA过程,并导致会有一个新建立的NAS安全上下文和NAS COUNT将设置为0。
- 否则,MME可以使用足够低的NAS COUNT值来激活non-current native EPS安全上下文或者发起新的AKA过程。
如果因为某些原因,新的KASME在NAS COUNT wrap around之前还没有使用AKA来建立,节点(MME或者UE)需要发送NAS消息就应该代替释放NAS信令连接。先于发送下一个上行NAS消息,UE应该删除指示current EPS安全上下文的eKSI。
当EIA0用来NAS完整性算法,UE和MME应该允许NAS COUNT wrap around。如果NAS COUNT wrap around发生,下面的需要将会适用:
- UE和MME应该继续适用current 安全上下文。
- MME不应该发起EPS AKA过程
- MME不应该释放NAS信令连接
- UE不应该执行本地对NAS信令连接的释放。
4.4.4 Integrity protection of NAS signalling messages
4.4.4.1 General
对于UE,一旦有有效的EPS安全上下文存在并且已经投入使用,NAS消息的完整性保护信令是必须的。对于网络,一旦NAS信令连接的NAS消息安全交换已经建立了,NAS消息的完整性保护信令也是必须的。所有NAS信令消息的完整性保护是NAS的职责。完整性保护是网络来激活的。
在current 安全上下文中“null完整性保护算法”EIA0只允许在非授权的UE在紧急承载建立时才允许使用。为了设定NAS消息的安全头类型,UE和MME应该应用相同的规则,不管是在安全上下文中指定的是“null完整性保护算法”或者是任何其他完整性保护算法。
如果“null完整性保护算法”EIA0选择作为完整性保护算法,接收端应该认为使用安全头指示为完整性保护的NAS消息是完整性保护的。
完整性保护的和NAS信令消息的验证详细过程见规范3GPP TS 33.401 [19].
当加密和完整性保护都激活时,NAS消息首先加密然后再把加密过的NAS消息和NAS序列号使用计算出来的MAC来完整性保护。
当只有完整性保护激活,加密没有激活时,未加密的NAS消息和NAS序列号使用计算出来的MAC来进行完整性保护。
当在EPS attach过程,ESM消息附带在EMM消息后面,只有一个sequence number IE和一个消息authentication code IE(对于combined NAS消息)。
4.4.4.2 Integrity checking of NAS signalling messages in the UE
除了下面列出的消息,没有NAS信令消息应该在UE中通过接收EMM实体或者转发到ESM实体来处理,直到网络为NAS信令建立建立了NAS消息的安全交换:
- EMM消息
- IDENTITY REQUEST(如果请求的ID参数是IMSI)
- AUTHENTICATION REQUEST
- AUTHENTICATION REJECT
- ATTACH REJECT (if the EMM cause is not # 25);
- DETACH ACCEPT (for non switch off);
- TRACKING AREA UPDATE REJECT (if the EMM cause is not # 25);
- SERVICE REJECT (if the EMM cause is not # 25).
NOTE:这些消息是被UE没有完整性保护接收的,因为在特定的情景,这些消息是在安全被激活之前由网络来发送的。
所有的ESM消息都是完整性保护的。
一旦NAS消息的安全交换已经建立了,UE的EMM或者ESM接收实体不应该处理任何NAS信令消息,直到这些消息已经被NAS成功完整性检查了。如果NAS信令消息还没有成功的通过完整性检查时接收到了,接着UE的NAS应该丢弃这个消息。SECURITY MODE COMMAND消息的处理还没有被成功通过完整性检查(specified in subclause 5.4.3.5)。如果任何NAS消息是没有完整性保护接收到了(即使网络已经建立起来了NAS消息的安全交换),NAS都应该丢失这个消息。
4.4.4.3 Integrity checking of NAS signalling messages in the MME
除了下面列出的消息,没有NAS信令消息应该在UE中通过接收EMM实体或者转发到ESM实体来处理,直到网络为NAS信令建立建立了NAS消息的安全交换:
- EMM消息
- ATTACH REQUEST
- IDENTITY REQUEST(如果请求的ID参数是IMSI)
- AUTHENTICATION RESPONSE;
- AUTHENTICATION FAILURE;
- SECURITY MODE REJECT;
- DETACH REQUEST;
- DETACH ACCEPT;
- TRACKING AREA UPDATE REQUEST.
NOTE:TRACKING AREA UPDATE REQUEST消息是由UE没有使用完整性保护发送的,如果TAU消息是由于idle模式下系统间切换引起的,并且UE中没有current EPS安全上下文。另外一些被不使用完整性保护被MME接收,因为特定的情况,他们是在安全被激活之前由UE发送的。
所有的ESM消息都是完整性保护的,除了PDN CONNECTIVITY REQUEST,如果它是附在ATTACH REQUEST消息后面,并且NAS安全没有激活时发送的。
一旦NAS消息的安全交换已经建立了,直到为NAS信令连接建立了NAS消息安全交换,MME的接收端EMM实体应该处理下面的NAS信令,尽管包含在消息中的MAC完整性检查失败或者不能检查,因为EPS安全上下文在网络中不可用:
- ATTACH REQUEST;
- IDENTITY RESPONSE (if requested identification parameter is IMSI);
- AUTHENTICATION RESPONSE;
- AUTHENTICATION FAILURE;
- SECURITY MODE REJECT;
- DETACH REQUEST (if sent before security has been activated);
- DETACH ACCEPT;
- TRACKING AREA UPDATE REQUEST;
- SERVICE REQUEST;
- EXTENDED SERVICE REQUEST.
NOTE 2: 这些消息是在当MAC完整性检查失败或者不能验证的时候由MME处理的,因为在特定的情况下,这些消息是由UE使用在网络端失效的EPS安全上下文保护来发送的。
如果ATTACH REQUEST消息完整性检查失败,且不是对紧急承载服务的attach 请求,MME应当在进一步处理attach request之前对用户鉴权。对于紧急承载服务的attach过程的处理参看subclause 5.5.1.2.3 and subclause 5.4.2.5.
如果RACKING AREA UPDATE REQUEST 消息完整性检查失败,且UE在TRACKING AREA UPDATE REQUEST消息中提供了一个nonce-UE,GPRS加密秘钥序列号,P-TMSI和RAI。MME应该发起security mode control过程把一个新的mapped EPS安全上下文投入使用;否则,如果UE仅仅有一个对非紧急承载服务的PDN连接,MME应当发起鉴权过程。对于UE有一个紧急承载服务的PDN连接的情况参考subclause 5.5.3.2.3 and subclause 5.4.2.5。
如果SERVICE REQUEST or EXTENDED SERVICE REQUEST消息完整性检查失败,并且UE仅仅只有非紧急承载服务的PDN连接,MME应当发送SERVICE REJECT,并且EMM原因为 # 9 “UE identity cannot be derived by the network”,并保留EMM上下文和EPS安全上下文不变。当UE有一个紧急承载服务的PDN连接,且完整性检查失败,即使没有EPS安全上下文可用,MME可能may跳过鉴权过程,并直接按照subclause 5.4.3.处理security mode control 过程的处理。在成功完成service request过程之后,网络应当去激活所有的非紧急EPS承载。紧急EPS承载不应当被去激活。
一旦NAS消息的安全交换已经建立,在MME中接收EMM和ESM实体不应该处理任何NAS信令消息,除非这些消息已经被NAS成功完整性检查了。如果任何NAS信令消息在没有成功通过完整性检查时收到了,MME的NAS应当丢弃这个消息。如果任何接收到的NAS信令消息,即使NAS消息的安全交换已经建立,但仍没有完整性保护,NAS应当丢弃这个消息。
4.4.5 Ciphering of NAS signalling messages
网络端加密的使用是一个运营商的选择,取决于MME配置。当网络运营商没有配置加密,MME应当在current安全上下文中对所有的UE指示"null ciphering algorithm" EEA0 (see subclause 9.9.3.23) 。对于在NAS的外面设置了安全头类型的,UE和MME应当应用相同的规则,不管"null ciphering algorithm"或者在安全上下文中指示的任何加密算法。
当UE建立了一个新的NAS信令连接,应该发送不加密的初始NAS消息。
UE应当发送ATTACH REQUEST消息,一直不加密。
UE应当发送TRACKING AREA UPDATE REQUEST消息,一直不加密。
当NAS消息的安全交换已经建立时,UE应当开始开始NAS消息的加密和解密。从这个时间点开始,除了显式定义的,UE应当发送所有的加密的NAS消息,直到NAS信令连接释放,或者UE执行系统间切换到A/Gb或者Iu模式。
MME应当如subclause 4.4.2.3描述的开始NAS消息的加密和解密。从这个时间点开始,除了SECURITY MODE COMMAND 消息,MME应当发送所有的加密的NAS消息知道NAS信令连接释放,或者UE执行系统间切换到A/Gb或者Iu模式。
一旦在MME和UE之间的NAS开始加密,接收到应该丢弃没有加密的NAS消息(这些NAS消息根据规范中描述的规则应当加密而没有加密)。
如果选择"null ciphering algorithm" EEA0作为加密算法,包含指示加密的安全头的NAS消息认为是加密的。
NAS信令消息的详细加密和解密过程见规范3GPP TS 33.401 [19].
4.5 Disabling and re-enabling of UE’s E-UTRA capability
当UE disable E-UTRA能力,UE应该按照如下处理:
a)选择注册的PLMN或者equivalent PLMN的另一个RAT(GERAN or UTRAN)。
b)如果注册的PLMN或者equivalent PLMN的另一个RAT不能找到,就按照3GPP TS 23.122 [6]执行PLMN选择。如果E-UTRA能力的disable不是因为UE对EPS only服务发起detach过程,UE可能(may)重现enable 这个PLMN选择的E-UTRA能力
c)如果没有其他允许的PLMN和RAT组合可用,UE可能may保留对注册的PLMN的E-UTRAN的EPS服务的注册。如果UE选择这个选项,UE可能may周期性的尝试选择一个能提供non-EPS服务的另一个PLMN和RAT组合。至于怎么周期性的扫描,这是根据UE的实现决定。
如果E-UTRA能力的disable不是因为UE发起对EPS only服务的detach过程,并且E-UTRA能力在执行上面的b) or c)时没有重新enable,接着UE应该在执行PLMN选择时重新enable E-UTRA能力。
如果UE disable E-UTRA能力是因为IMS 语音不可用和CSFB不可用,在当PLMN选择执行的时候将重选enable E-UTRA能力,接着UE应该记住E-UTRA能力disable时PLMN的ID,并且在接下来的PLMN选择中使用存储的信息来执行3GPP TS 23.122 [6]。
当支持A/Gb and/or Iu mode和S1 mode的UE需要待在A/Gb or Iu mode,为了避免不必要的从UTRAN/GERAN到E-UTRAN切换或者小区重选,UE应当disable E-UTRA能力。
- 在ATTACH REQUEST消息和UE在重选到GERAN或者UTRAN之后的ROUTING AREA UPDATE REQUEST消息,UE不应当设置MS Radio Access capability IE的E-UTRA支持bit (see 3GPP TS 24.008 [13], subclause 10.5.5.12a),Mobile Station Classmark 3 IE的E-UTRA支持bit(see 3GPP TS 24.008 [13], subclause 10.5.1.7),MS network capability IE的ISR 支持bit (see 3GPP TS 24.008 [13], subclause 10.5.5.12) ,
- 在ATTACH REQUEST消息和ROUTING AREA UPDATE REQUEST消息中,UE应当使用MS network capability IE中的EPC能力bit相同的值(see 3GPP TS 24.008 [13], subclause 10.5.5.12)。
- UE NAS层应该指示给接入层AS,E-UTRA能力的disable。
- 在ATTACH REQUEST消息和UE在重选到GERAN或者UTRAN之后的ROUTING AREA UPDATE REQUEST消息,如果在UE的E-UTRA能力disable之后有任何能力bit的改变,UE应当改变MS network capability IE(see 3GPP TS 24.008 [13], subclause 10.5.5.12)。
NOTE:在EMM-idle模式,UE可以仅仅disable E-UTRA能力。
如果UE在选择到GERAN or UTRAN RAT之前,UE在disable UE的E-UTRA能力, UE不应该执行detach过程,subclause 5.5.2.1.
如果UE需要disable E-UTRA并选择GERAN或者UTRAN RAT上,且UE在EMM-CONNECTED mode,UE应该在选择GERAN或者UTRAN RAT之前释放建立的NAS信令连接,并进入EMM-idle mode。
如果E-UTRA能力时因为尝试选择GERAN或者UTRAN RAT处理CS紧急呼叫建立而disable E-UTRA能力(see subclause 4.3.1),enable E-UTRA能力是UE实现相关。
- the UE mode of operation changes from CS/PS mode 1 of operation to CS/PS mode 2 of operation;
- the UE mode of operation changes from PS mode 1 of operation to PS mode 2 of operation; or
- the UE powers off and powers on again or the USIM is removed;
As an implementation option, the UE may start a timer for enabling E-UTRA when the UE’s attach attempt counter or tracking area updating attempt counter reaches 5 and the UE disables E-UTRA capability for cases described in subclauses 5.5.1.3.4.3, 5.5.1.3.6, 5.5.3.3.4.3 and 5.5.3.3.6. On expiry of this timer:
- if the UE is in Iu mode or A/Gb mode and is in idle mode as specified in 3GPP TS 24.008 [13] on expiry of the timer, the UE should enable the E-UTRA capability;
- if the UE is in Iu mode or A/Gb mode and an RR connection exists, the UE shall delay enabling E-UTRA capability until the RR connection is released; and
- if the UE is in Iu mode and a PS signalling connection exists but no RR connection exists, the UE may abort the PS signalling connection before enabling E-UTRA capability.
For other cases, it is up to the UE implementation when to enable the E-UTRA capability.
如果E-UTRA能力disable是因为UE对EPS only服务发起detach过程(see subclause 5.5.2.2.2),一旦上层请求re-attach EPS服务,UE应当重新enable E-UTRA。如果E-UTRA disable是因为接收到EMM cause # 14 “EPS services not allowed in this PLMN”, 当UE关机并且重新或者USIM卡移除时,UE应当重新enable E-UTRA能力。如果E-UTRA能力disable是因为其他原因,UE应该按照如下方式来enable E-UTRA能力:
- UE操作模式从CS/PS mode 1转换到CS/PS mode 2
- UE操作模式从PS mode 1转换到PS mode 2
- UE关机重启或者USIM移除。
作为实现的一个选择选项,当UE 的attach 尝试计数器或者TAU尝试计数器到达5时,UE may可能开启一个enable E-UTRA的定时器,并UE disable E-UTRA能力subclauses 5.5.1.3.4.3, 5.5.1.3.6, 5.5.3.3.4.3 and 5.5.3.3.6.。一旦这个定时器超时:
- 如果UE在 Iu mode or A/Gb mode,并且在idle状态(specified in 3GPP TS 24.008 [13]),一旦定时器超时,UE应该enable E-UTRA能力。
- 如果UE在 Iu mode or A/Gb mode,并且RR连接存在,UE应该延迟enable E-UTRA能力直到RR连接释放。
- 如果UE在 Iu mode ,并且PS连接存在,但是RR连接不存在,UE may可能在enable E-UTRA能力之前终止PS连接。
对于其他的情况,视UE的实现来决定什么时候enable E-UTRA 能力。
4.6 Applicability of procedures
4.6.1 Relay nodes
中继节点应该支持对于一个支持S1模式的UE必选的所有的过程。
也有一个功能仅仅适用于中继节点,在那样的情况下使用名字”中继节点“代替”UE“.
5 Elementary procedures for EPS mobility management
5.1 Overview
5.1.1 General
这章主要描述在LTE-Uu接口上EMM的过程。
EMM层主要的功能是支持UE的移动性,例如通知网络UE当前的位置并提供保密的用户ID。
EMM层的另一个功能是为SM(会话管理)层和CM(连接管理)层的SMS实体提供连接管理服务。
在本章中描述的所有EMM过程仅仅在UE和网络之间建立NAS信令连接的基础上执行的。如果没有信令连接,EMM层需要发起NAS信令连接的建立(see 3GPP TS 36.331 [22]).
5.1.2 Types of EMM procedures
根据这些消息的发起的方式,EMM过程可以分为三种类型:
1)EMM common procedure:
只要NAS信令连接存在,总是可以发起EMM公共过程的。属于这个类型的过程有:
网络端发起的:
- GUTI reallocation;
- authentication;
- security mode control;
- identification;
- EMM information.
2)EMM specific procedures:
在任何时间,UE只能有一个EMM specific procedure正在运行。属于这种类型的过程有:
由UE发起并且用IMSI attach 到网络的EPS服务或者non-EPS服务,并建立EMM上下文和默认承载:
- attach and combined attach.
由UE发起并且用IMSI或者IMEI attach 到网络的紧急承载服务,并建立到PDN的EMM上下文和默认承载提供紧急承载服务:
由UE发起或者由网络发起,并且用IMSI deattach 网络的EPS或者non-EPS服务,并释放EMM上下文和所有的承载:
- detach and combined detach.
当EM上下文建立时,由UE发起:
- normal tracking area updating and combined tracking area updating (S1 mode only);
- periodic tracking area updating (S1 mode only).
TAU过程可以用来为发送数据来请求资源预留。
3) EMM connection management procedures (S1 mode only):
由UE发起,并且用来建立到网络的安全连接或者为发送数据请求资源预留:
- service request.
service request过程仅仅当没有UE发起EMM specific procedure时才能发起。
由网络发起,并且用来请求NAS信令连接的建立或者在网络失败时如果有必要促使UE重新attach。
由UE发起或者网络发起,用来传输NAS消息:
- transport of NAS messages;
- generic transport of NAS messages.
transport of NAS messages过程和generic transport of NAS messages过程不能在EMM specific procedure或者service request procedure过程正在进行时发起。
5.1.3 EMM sublayer states
5.1.3.1 General
5.1.3.2 EMM sublayer states in the UE
5.1.3.3 EPS update status
5.1.3.4 EMM sublayer states in the MME
5.1.3.1 General
在下面的章节中,UE和网络EMM协议被描述为两个不同的状态机。在subclause 5.1.3.2中,引入了UE中EMM实体的状态。UE的行为依赖于subclause 5.1.3.3描述的EPS更新状态。MME端的状态描述在subclause 5.1.3.4。
5.1.3.2 EMM sublayer states in the UE
5.1.3.2.1 General
5.1.3.2.2 Main states
5.1.3.2.3 Substates of state EMM-DEREGISTERED
5.1.3.2.4 Substates of state EMM-REGISTERED
5.1.3.2.1 General
在接下来的章节中,UE中EMM实体可能的EMM状态将描述。Subclause 5.1.3.2.2总结EMM实体的主状态。子状态在subclause 5.1.3.2.3 and subclause 5.1.3.2.4中描述。
应该注意的是,这些子状态并不包含UE在单个状态下详细行为的描述,也不包含不正常的情况。UE行为的详细描述在subclause 5.2。对于UE在不正常情况下的行为描述在subclauses 5.4, 5.5, 5.6 and 5.7。
5.1.3.2.2 Main states
5.1.3.2.2.1 EMM-NULL
5.1.3.2.2.2 EMM-DEREGISTERED
5.1.3.2.2.3 EMM-REGISTERED-INITIATED
5.1.3.2.2.1 EMM-NULL
EPS services are disabled in the UE. No EPS mobility management function shall be performed in this state.
5.1.3.2.2.2 EMM-DEREGISTERED
In the state EMM-DEREGISTERED, no EMM context has been established and the UE location is unknown to an MME and hence it is unreachable by an MME. In order to establish an EMM context, the UE shall start the attach or combined attach procedure (see subclause 5.5.1).
5.1.3.2.2.3 EMM-REGISTERED-INITIATED
A UE enters the state EMM-REGISTERED-INITIATED after it has started the attach or the combined attach procedure and is waiting for a response from the MME (see subclause 5.5.1).
5.1.3.2.2.4 EMM-REGISTERED
In the state EMM-REGISTERED an EMM context has been established and a default EPS bearer context has been activated in the UE. When the UE is in EMM-IDLE mode, the UE location is known to the MME with an accuracy of a list of tracking areas containing a certain number of tracking areas. When the UE is in EMM-CONNECTED mode, the UE location is known to the MME with an accuracy of a serving eNodeB. The UE may initiate sending and receiving user data and signalling information and reply to paging. Additionally, tracking area updating or combined tracking area updating procedure is performed (see subclause 5.5.3).
5.1.3.2.2.5 EMM-DEREGISTERED-INITIATED
A UE enters the state EMM-DEREGISTERED-INITIATED after it has requested release of the EMM context by starting the detach or combined detach procedure and is waiting for a response from the MME (see subclause 5.5.2).
5.1.3.2.2.6 EMM-TRACKING-AREA-UPDATING-INITIATED
A UE enters the state EMM-TRACKING-AREA-UPDATING-INITIATED after it has started the tracking area updating or combined tracking area updatingprocedure and is waiting for a response from the MME (see subclause 5.5.3).
5.1.3.2.2.7 EMM-SERVICE-REQUEST-INITIATED
A UE enters the state EMM-SERVICE-REQUEST-INITIATED after it has started the service request procedure and is waiting for a response from the MME (see subclause 5.6.1).
NOTE: Not all possible transitions are shown in this figure.
Figure 5.1.3.2.2.7.1: EMM main states in the UE
5.1.3.2.3 Substates of state EMM-DEREGISTERED
5.1.3.2.3.1 General
The state EMM-DEREGISTERED is subdivided into a number of substates as described in this subclause. Valid subscriber data are available for the UE before it enters the substates, except for the substate EMM-DEREGISTERED.NO-IMSI.
5.1.3.2.3.2 EMM-DEREGISTERED.NORMAL-SERVICE
The substate EMM-DEREGISTERED.NORMAL-SERVICE is chosen in the UE, if the EPS update status is EU1 or EU2, in the meantime a suitable cell has been found and the PLMN or tracking area is not in the forbidden list.
5.1.3.2.3.3 EMM-DEREGISTERED.LIMITED-SERVICE
The substate EMM-DEREGISTERED.LIMITED-SERVICE is chosen in the UE, if the EPS update status is EU3, and it is known that a selected cell is unable to provide normal service (e.g. the selected cell is in a forbidden PLMN, is in a forbidden tracking area or the selected cell is a CSG cell whose CSG ID and associated PLMN identity are not included in the UE’s Allowed CSG list or in the UE’s Operator CSG List).
5.1.3.2.3.4 EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH
The substate EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH is chosen in the UE, if the EPS update status is EU2, and a previous attach was not successful.
5.1.3.2.3.5 EMM-DEREGISTERED.PLMN-SEARCH
The substate EMM-DEREGISTERED.PLMN-SEARCH is chosen in the UE, if the UE with a valid USIM is switched on.
5.1.3.2.3.6 EMM-DEREGISTERED.NO-IMSI
The substate EMM-DEREGISTERED.NO-IMSI is chosen in the UE, if the UE is switched on without a valid USIM inserted.
5.1.3.2.3.7 EMM-DEREGISTERED.ATTACH-NEEDED
Valid subscriber data are available for the UE and for some reason an attach must be performed as soon as possible. This substate can be entered if the access class is blocked due to access class control, or if the network rejects the NAS signalling connection establishment.
5.1.3.2.3.8 EMM-DEREGISTERED.NO-CELL-AVAILABLE
No E-UTRAN cell can be selected. This substate is entered after a first intensive search failed when in substate EMM-DEREGISTERED.PLMN-SEARCH. Cells are searched for at a low rhythm. No EPS services are offered.
5.1.3.2.4 Substates of state EMM-REGISTERED
5.1.3.2.4.1 General
The state EMM-REGISTERED is subdivided into a number of substates as described in this subclause.
5.1.3.2.4.2 EMM-REGISTERED.NORMAL-SERVICE
The substate EMM-REGISTERED.NORMAL-SERVICE is chosen by the UE as the primary substate when the UE enters the state EMM-REGISTERED.
5.1.3.2.4.3 EMM-REGISTERED.ATTEMPTING-TO-UPDATE
The substate EMM-REGISTERED.ATTEMPTING-TO-UPDATE is chosen by the UE if the tracking area updating or combined tracking area updating procedure failed due to a missing response from the network or due to the circumstances described in subclauses 5.5.3.2.5, 5.5.3.2.6, 5.5.3.3.5, 5.6.1.5 and 5.6.1.6. No EMM procedure except the tracking area updating or combined tracking area updating procedure shall be initiated by the UE in this substate. No data shall be sent or received.
5.1.3.2.4.4 EMM-REGISTERED.LIMITED-SERVICE
The substate EMM-REGISTERED.LIMITED-SERVICE is chosen in the UE, if the cell the UE selected is known not to be able to provide normal service.
5.1.3.2.4.5 EMM-REGISTERED.PLMN-SEARCH
The substate EMM-REGISTERED.PLMN-SEARCH is chosen in the UE, while the UE is searching for PLMNs.
5.1.3.2.4.6 EMM-REGISTERED.UPDATE-NEEDED
The UE has to perform a tracking area updating or combined tracking area updating procedure, but access to the current cell is barred. This state can be entered if the access class is blocked due to access class control, or if the network rejects the NAS signalling connection establishment. No EMM procedure except tracking area updating or combined tracking area updating or service request as a response to paging shall be initiated by the UE in this substate.
5.1.3.2.4.7 EMM-REGISTERED.NO-CELL-AVAILABLE
E-UTRAN coverage has been lost or PSM is active in the UE. If PSM is active, the UE may initiate sending and receiving user data. Otherwise, the UE shall not initiate any EMM procedure except for cell and PLMN reselection.
5.1.3.2.4.8 EMM-REGISTERED.ATTEMPTING-TO-UPDATE-MM
A combined attach procedure or a combined tracking area updating procedure was successful for EPS services only. User data and signalling information may be sent and received.
5.1.3.2.4.9 EMM-REGISTERED.IMSI-DETACH-INITIATED
The UE performs a combined detach procedure for non-EPS services only (detach type “IMSI detach”). This substate is entered if the UE is attached for EPS and non-EPS services and wants to detach for non-EPS services only. User data and signalling information may be sent and received.
5.1.3.3 EPS update status
In order to describe the detailed UE behaviour, the EPS update (EU) status pertaining to a specific subscriber is defined.
The EPS update status is stored in a non-volatile memory in the USIM if the corresponding file is present in the USIM, else in the non-volatile memory in the ME, as described in annex C.
The EPS update status value is changed only after the execution of an attach or combined attach, network initiated detach, authentication, tracking area update or combined tracking area update, service request or paging for EPS services using IMSI procedure.
EU1: UPDATED
The last attach or tracking area updating attempt was successful.
EU2: NOT UPDATED
The last attach, service request or tracking area updating attempt failed procedurally, i.e. no response or reject message was received from the MME.
EU3: ROAMING NOT ALLOWED
The last attach, service request or tracking area updating attempt was correctly performed, but the answer from the MME was negative (because of roaming or subscription restrictions).
5.1.3.4 EMM sublayer states in the MME
5.1.3.4.1 EMM-DEREGISTERED
In the state EMM-DEREGISTERED, the MME has no EMM context or the EMM Context is marked as detached. The UE is detached. The MME may answer to an attach or a combined attach procedure initiated by the UE (see subclause 5.5.1). The MME may also answer to a tracking area updating procedure or combined tracking area updating procedure initiated by a UE if the EMM context is marked as detached. The MME may also answer to a detach procedure initiated by the UE (see subclause 5.5.1.2.7).
If ISR is not activated or ISR is deactivated during a routing area updating or combined routing area updating procedure or an inter-system handover to A/Gb mode or Iu mode, the MME enters the state EMM-DEREGISTERED after the successful completion of the procedure.
5.1.3.4.2 EMM-COMMON-PROCEDURE-INITIATED
The MME enters the state EMM-COMMON-PROCEDURE-INITIATED, after it has started a common EMM procedure (see subclause 5.4) and is waiting for a response from the UE.
5.1.3.4.3 EMM-REGISTERED
In the state EMM-REGISTERED, an EMM context has been established and a default EPS bearer context has been activated in the MME.
5.1.3.4.4 EMM-DEREGISTERED-INITIATED
The MME enters the state EMM-DEREGISTERED-INITIATED after it has started a detach procedure and is waiting for a response from the UE (see subclause 5.5.2).
Figure 5.1.3.4.4.1: EMM main states in the MME
5.1.4 Coordination between EMM and GMM
If GMM and EMM are both enabled, a UE capable of S1 mode and A/Gb mode or Iu mode or both shall maintain one common registration for GMM and EMM indicating whether the UE is registered for packet services or not.
A UE that is not registered shall be in state GMM-DEREGISTERED and in state EMM-DEREGISTERED.
If the UE performs a successful attach or combined attach procedure in S1 mode, it shall enter substates GMM-REGISTERED.NO-CELL-AVAILABLE and EMM-REGISTERED.NORMAL-SERVICE. The UE resets the attach attempt counter and the GPRS attach attempt counter (see 3GPP TS 24.008 [13]).
If the UE performs a successful GPRS attach or combined GPRS attach procedure in A/Gb or Iu mode, it shall enter substates GMM-REGISTERED.NORMAL-SERVICE and EMM-REGISTERED.NO-CELL-AVAILABLE. The UE resets the attach attempt counter and the GPRS attach attempt counter (see 3GPP TS 24.008 [13]).
At intersystem change from A/Gb or Iu mode to S1 mode when no PDP context is active, the UE shall move to state EMM-DEREGISTERED and state GMM-DEREGISTERED and then initiate an attach procedure.
After successful completion of routing area updating or combined routing area updating and tracking area updating or combined tracking area updating procedures in both S1 mode and A/Gb or Iu mode, if the network has indicated that ISR is activated, the UE shall maintain registration and related periodic update timers in both GMM and EMM.
5.1.5 Coordination between EMM and MM
UEs that operate in CS/PS mode 1 or CS/PS mode 2 of operation shall use the combined EPS/IMSI attach procedure in order to attach to both EPS and non-EPS services.
UEs that operate in CS/PS mode 1 or CS/PS mode 2 of operation and are already attached to both EPS and non-EPS services shall use the combined tracking area updating and periodic tracking area updating procedures.
UEs that operate in CS/PS mode 1 or CS/PS mode 2 of operation and are already attached to both EPS and non-EPS services shall perform a combined detach procedure in order to detach for non-EPS services.
UEs that operate in CS/PS mode 1 or CS/PS mode 2 of operation should not use any MM timers related to MM specific procedures (e.g. T3210, T3211, T3212, T3213) while camped on E-UTRAN, unless the re-activation of these timers is explicitly described. If the MM timers are already running, the UE should not react on the expiration of the timers.
5.2 Behaviour of the UE in state EMM-DEREGISTERED and state EMM-REGISTERED
5.2.1 General
In this subclause, the detailed behaviour of the UE in the states EMM-DEREGISTERED and EMM-REGISTERED is described.
5.2.2 UE behaviour in state EMM-DEREGISTERED
5.2.2.1 General
The state EMM-DEREGISTERED is entered in the UE, when:
- the detach or combined detach is performed either by the UE or by the MME (see subclause 5.5.2);
- the attach request is rejected by the MME (see subclause 5.5.1);
- the tracking area update request is rejected by the MME (see subclause 5.5.3);
- the service request procedure is rejected by the MME (see subclause 5.6.1);
- the UE deactivates all EPS bearer contexts locally (see subclause 6.4.4.6);
- the UE is switched on;
- an inter-system change from S1 mode to non 3GPP access is completed and the non 3GPP access network provides PDN connectivity to the same EPC; or
- the UE attached for emergency bearer services is in EMM-IDLE mode and its periodic tracking area update timer expires (see subclause 5.3.5).
In state EMM-DEREGISTERED, the UE shall behave according to the substate as explained in subclause 5.2.2.3.
5.2.2.2 Primary substate selection
5.2.2.2.1 Selection of the substate after power on
When the UE is switched on, the substate shall be PLMN-SEARCH if the USIM is available and valid. See 3GPP TS 23.122 [6] for further details.
The substate chosen after PLMN-SEARCH, following power on is:
- if no cell can be selected, the substate shall be NO-CELL-AVAILABLE;
- if no USIM is present, the substate shall be NO-IMSI;
- if a suitable cell has been found and the PLMN or tracking area is not in the forbidden list, then the substate shall be NORMAL-SERVICE;
- if the selected cell is known not to be able to provide normal service, then the UE shall enter the substate LIMITED-SERVICE;
- if the UE is in manual network selection mode and no cell of the selected PLMN has been found, the UE shall enter the substate NO-CELL-AVAILABLE; and
- if the selected cell is a non-3GPP cell, the substate shall be NO-CELL-AVAILABLE.
5.2.2.3 Detailed description of UE behaviour in state EMM-DEREGISTERED
5.2.2.3.1 NORMAL-SERVICE
The UE shall initiate an attach or combined attach procedure.
5.2.2.3.2 LIMITED-SERVICE
The UE shall initiate an attach or combined attach procedure when entering a cell which provides normal service.
The UE may initiate attach for emergency bearer services.
5.2.2.3.3 ATTEMPTING-TO-ATTACH
The UE:
- shall initiate an attach or combined attach procedure on the expiry of timers T3411, T3402 or T3346 (see 3GPP TS 24.008 [13]);
- may initiate an attach for emergency bearer services even if timer T3346 is running;
- shall initiate an attach or combined attach procedure when entering a new PLMN not in the list of equivalent PLMNs, if the PLMN identity of the new cell is not in one of the forbidden PLMN lists and the tracking area is not in one of the lists of forbidden tracking areas;
- shall initiate an attach or combined attach procedure when the tracking area of the serving cell in the current PLMN or equivalent PLMN has changed, if timer T3346 is not running and the tracking area of the new cell is not in one of the lists of forbidden tracking areas;
- shall use requests for non-EPS services from CM layers to trigger a combined attach procedure, if timer T3346 is not running (see subclause 5.5.1.3); and
- may initiate an attach procedure upon request of the upper layers to establish a PDN connection for emergency bearer services, if timer T3346 is not running.
5.2.2.3.4 PLMN-SEARCH
The UE shall perform PLMN selection. If a new PLMN is selected, the UE shall reset the attach attempt counter and initiate the attach or combined attach procedure (see subclause 5.5.1).
If the selected cell is known not to be able to provide normal service, the UE may initiate attach for emergency bearer services.
5.2.2.3.5 NO-IMSI
The UE shall perform cell selection according to 3GPP TS 36.304 [21].
The UE may initiate attach for emergency bearer services.
5.2.2.3.6 ATTACH-NEEDED
The UE shall initiate the attach or combined attach procedure, if still needed, as soon as the access is allowed in the selected cell for one of the access classes of the UE.
The UE may initiate attach for emergency bearer services.
5.2.2.3.7 NO-CELL-AVAILABLE
The UE shall perform cell selection according to 3GPP TS 36.304 [21] and choose an appropriate substate when a cell is found. When the lower layers indicate to prepare for an S101 mode to S1 mode handover and the PLMN identity of the target cell provided with this indication is not in one of forbidden PLMN lists, the UE shall enter substate NORMAL-SERVICE.
NOTE: It is assumed that the UE can determine the PLMN identity of networks supporting cdma2000® HRPD access from the information broadcast over the radio interface. For the purpose of S101 mode to S1 mode handover, the UE can use the PLMN identity of the visited cdma2000® HRPD network also as PLMN identity of the target cell.
5.2.2.4 Substate when back to state EMM-DEREGISTERED from another EMM state
When returning to state EMM-DEREGISTERED, the UE shall select a cell as specified in 3GPP TS 36.304 [21].
The substate depends on the result of the cell selection procedure, the outcome of the previously performed EMM specific procedures, on the EPS update status of the UE, on the tracking area data stored in the UE and on the presence of the USIM:
- If no cell has been found, the substate is NO-CELL-AVAILABLE, until a cell is found.
- If no USIM is present or if the inserted USIM is considered invalid by the UE, the substate shall be NO-IMSI.
- If a suitable cell has been found and the PLMN or tracking area is not in the forbidden list, the substate shall be NORMAL-SERVICE.
- If an attach shall be performed (e.g. network requested re-attach), the substate shall be ATTEMPTING-TO-ATTACH.
- If a PLMN reselection (according to 3GPP TS 23.122 [6]) is needed, the substate shall be PLMN-SEARCH.
- If the selected cell is known not to be able to provide normal service, the substate shall be LIMITED-SERVICE; and
- if the selected cell is a non-3GPP cell, the substate shall be NO-CELL-AVAILABLE.
5.2.3 UE behaviour in state EMM-REGISTERED
5.2.3.1 General
The state EMM-REGISTERED is entered at the UE, when:
- the attach or combined attach procedure is performed by the UE (see subclause 5.5.1).
In state EMM-REGISTERED, the UE shall behave according to the substate as explained in subclause 5.2.3.2.
5.2.3.2 Detailed description of UE behaviour in state EMM-REGISTERED
5.2.3.2.1 NORMAL-SERVICE
The UE:
- shall initiate normal and combined tracking area updating (according to conditions given in subclause 5.5.3);
- shall perform periodic tracking area updating (see subclause 5.5.3) except when attached for emergency bearer services (see subclause 5.3.5); and
- shall respond to paging.
5.2.3.2.2 ATTEMPTING-TO-UPDATE
The UE:
- shall not send any user data;
- shall initiate tracking area updating on the expiry of timers T3411, T3402 or T3346;
- shall initiate tracking area updating when entering a new PLMN not in the list of equivalent PLMNs, if the PLMN identity of the new cell is not in one of the forbidden PLMN lists, and the tracking area is not in one of the lists of forbidden tracking areas;
- shall initiate tracking area updating when the tracking area of the serving cell in the current PLMN or equivalent PLMN has changed, if timer T3346 is not running and this tracking area is not in one of the lists of forbidden tracking areas;
- may initiate a tracking area updating procedure upon request of the upper layers to establish a PDN connection for emergency bearer services, if timer T3346 is not running;
- may detach locally and initiate an attach for emergency bearer services even if timer T3346 is running;
- shall use requests for non-EPS services from CM layers to trigger a combined tracking area updating procedure, if timer T3346 is not running (see subclause 5.5.3.3);
- shall initiate tracking area updating in response to paging, if timer T3346 is running; and
- shall initiate tracking area updating if the EPS update status is set to EU2 NOT UPDATED, and timers T3411 and T3402 are not running.
5.2.3.2.3 LIMITED-SERVICE
The UE:
- shall perform cell selection/reselection according to 3GPP TS 36.304 [21];
- may respond to paging (with IMSI); and
- may initiate attach for emergency bearer services.
5.2.3.2.4 PLMN-SEARCH
The UE may enter this substate when it is in automatic network selection mode and the maximum allowed number of subsequently unsuccessful tracking area updating have been performed. The UE may also enter this substate as a result of a tracking area update rejected by the network (see subclause 5.5.3) or as a result of a service request rejected by the network (see subclause 5.6.1). If a new PLMN is selected, the UE shall reset the tracking area updating attempt counter and initiate the tracking area updating or combined tracking area updating procedure (see subclause 5.5.3).
If the selected cell is known not to be able to provide normal service, the UE may initiate attach for emergency bearer services.
5.2.3.2.5 UPDATE-NEEDED
The UE:
- shall not send any user data;
- shall not send signalling information, unless as a response to paging or due to a tracking area updating procedure upon request by the upper layers to establish a PDN connection for emergency bearer services;
- shall perform cell selection/reselection according to 3GPP TS 36.304 [21]; and
- shall enter the appropriate new substate depending on the EPS update status as soon as the access is allowed in the selected cell for one of the access classes of the UE.
5.2.3.2.6 NO-CELL-AVAILABLE
The UE shall perform cell selection/reselection according to 3GPP TS 36.304 [21].
5.2.3.2.7 ATTEMPTING-TO-UPDATE-MM
The UE:
- shall perform cell selection/reselection according to 3GPP TS 36.304 [21];
- shall be able to receive and transmit user data and signalling information; and
- shall initiate combined tracking area updating procedure indicating “combined TA/LA updating with IMSI attach” on the expiry of timers T3411 or T3402 or when the UE enters a tracking area not in the list of registered tracking areas.
5.2.3.2.8 IMSI-DETACH-INITIATED
The UE:
- shall be able to receive and transmit user data and signalling information; and
- shall initiate combined tracking area updating procedure (according to conditions given in subclause 5.5.3.3 or subclause 5.5.2.2.4).
5.3 General on elementary EMM procedures
5.3.1 EMM modes and NAS signalling connection
5.3.1.1 Establishment of the NAS signalling connection
When the UE is in EMM-IDLE mode and needs to transmit an initial NAS message, the UE shall request the lower layer to establish a RRC connection. In this request to the lower layer the NAS shall provide to the lower layer the RRC establishment cause and the call type as specified in annex D of this specification.
Initial NAS messages are:
- ATTACH REQUEST;
- DETACH REQUEST;
- TRACKING AREA UPDATE REQUEST;
- SERVICE REQUEST; and
- EXTENDED SERVICE REQUEST.
For the routing of the initial NAS message to the appropriate MME, the UE NAS provides the lower layers with either the S-TMSI or the registered globally unique MME identifier (GUMMEI) that consists of the PLMN ID, the MME group ID, and the MME code (see 3GPP TS 23.003 [2]) according to the following rules:
- If the TIN indicates “GUTI” or “RAT-related TMSI”, or the TIN is not available, and the UE holds a valid GUTI:
a) When the UE in EMM-IDLE mode initiates a tracking area updating or combined tracking area updating procedure for load balancing purposes, the UE NAS shall provide the lower layers with neither S-TMSI nor registered MME identifier;
b) When the tracking area of the current cell is in the list of tracking areas that the UE previously registered in the MME during the NAS signalling connection establishment, the UE NAS shall provide the lower layers with the S-TMSI, but shall not provide the registered MME identifier to the lower layers; or
c) When the tracking area of the current cell is not in the list of tracking areas that the UE previously registered in the MME during the NAS signalling connection establishment, the UE NAS shall provide the lower layers with the MME identifier part of the valid GUTI with an indication that the identifier is a native GUMMEI.
- If the TIN indicates “P-TMSI” and the UE holds a valid P-TMSI and RAI, the UE NAS shall provide the lower layers with the MME identifier part of the mapped GUTI, which is generated from the P-TMSI and RAI with an indication that the identifier is a mapped GUMMEI.
The UE NAS also provides the lower layers with the identity of the selected PLMN (see 3GPP TS 36.331 [22]). In a shared network, the UE shall choose one of the PLMN identities as specified in 3GPP TS 23.122 [6].
If a relay node is attaching for relay node operation (see 3GPP TS 23.401 [10]), the NAS in the relay node shall indicate to the lower layers that the establishment of the NAS signalling connection is for a relay node.
In S1 mode, when the RRC connection has been established successfully, the UE shall enter EMM-CONNECTED mode and consider the NAS signalling connection established.
In S101 mode, when the cdma2000® HRPD access network resources are available for tunnelled NAS signalling, the UE shall enter EMM-CONNECTED mode and consider the S101 mode NAS signalling connection established.
5.3.1.2 Release of the NAS signalling connection
The signalling procedure for the release of the NAS signalling connection is initiated by the network.
In S1 mode, when the RRC connection has been released, the UE shall enter EMM-IDLE mode and consider the NAS signalling connection released.
If the UE receives the “Extended wait time” from the lower layers when no attach, tracking area updating or service request procedure is ongoing, the UE shall ignore the “Extended wait time”.
To allow the network to release the NAS signalling connection, the UE shall start the timer T3440 in the following cases:
a) the UE receives any of the EMM cause values #11, #12, #13, #14 (not applicable to the service request procedure), #15 or #35;
b) the UE receives a TRACKING AREA UPDATE ACCEPT message and the UE has not set the “active” flag in the TRACKING AREA UPDATE REQUEST message, the tracking area updating or combined tracking area updating procedure has been initiated in EMM-IDLE mode and the user plane radio bearers have not been set up;
c) the UE receives a DETACH ACCEPT message and the UE has set the detach type to “IMSI detach” in the DETACH REQUEST message and user plane radio bearers have not been set up;
d) the UE receives a TRACKING AREA UPDATE REJECT message indicating any of the EMM cause values #9, #10 or #40; or
e) the UE receives a SERVICE REJECT message indicating any of the EMM cause values #9, #10 or #40 as a response to a SERVICE REQUEST message or an EXTENDED SERVICE REQUEST message with service type set to “packet services via S1”.
Upon expiry of T3440,
- in cases a, b and c, the UE shall locally release the established NAS signalling connection; or
- in cases d and e, the UE shall locally release the established NAS signalling connection and the UE shall initiate the attach procedure as described in subclause 5.5.3.2.5, 5.5.3.3.5 or 5.6.1.5.
In cases b and c,
- upon an indication from the lower layers that the user plane radio bearers are set up, the UE shall stop timer T3440 and may send uplink signalling via the existing NAS signalling connection or user data via the user plane bearers. If the uplink signalling is for CS fallback for emergency call, or for establishing a PDN connection for emergency bearer services, the UE shall send the uplink signalling via the existing NAS signalling connection; or
- upon receipt of a DETACH REQUEST message, the UE shall stop timer T3440 and respond to the network initiated detach as specified in subclause 5.5.2.3.
In case b,
upon receiving a request from upper layers to send NAS signalling not associated with establishing either a CS emergency call or a PDN connection for emergency bearer services, the UE shall wait for the timer T3440 to expire or be stopped before proceeding; or
upon receiving a request from upper layers to establish either a CS emergency call or a PDN connection for emergency bearer services, the UE shall stop timer T3440 and shall locally release the NAS signalling connection, before proceeding as specified in subclause 5.6.1.
In cases d and e,
- upon an indication from the lower layers that the RRC connection has been released, the UE shall stop timer T3440 and perform a new attach procedure as specified in subclause 5.5.3.2.5, 5.5.3.3.5 or 5.6.1.5.
In S101 mode, when the cdma2000® HRPD radio access connection has been released, the UE shall enter EMM-IDLE mode and consider the S101 mode NAS signalling connection released.
5.3.2 Lists of forbidden tracking areas
The UE shall store a list of “forbidden tracking areas for roaming”, as well as a list of “forbidden tracking areas for regional provision of service”. These lists shall be erased when the UE is switched off or when the UICC containing the USIM is removed, and periodically (with a period in the range 12 to 24 hours). When the lists are erased, the UE performs cell selection according to 3GPP TS 36.304 [21]. One or more tracking areas is removed from the list of “forbidden tracking areas for roaming” in the UE, as well as the list of “forbidden tracking areas for regional provision of service” if, after a subsequent procedure e.g. attach procedure, tracking area updating procedure and GUTI reallocation procedure, one or more tracking areas in the lists is received from the network. If the UE has only one PDN connection established which is for emergency bearer services, the tracking areas shall not be removed from these lists if one or more tracking areas in the lists are received from the network.
In S1 mode, the UE shall update the suitable list whenever an ATTACH REJECT, TRACKING AREA UPDATE REJECT, SERVICE REJECT or DETACH REQUEST message is received with the EMM cause #12 “tracking area not allowed”, #13 “roaming not allowed in this tracking area”, or #15 “no suitable cells in tracking area”.
Each list shall accommodate 40 or more TAIs. When the list is full and a new entry has to be inserted, the oldest entry shall be deleted.
5.3.3 List of forbidden PLMNs for attach in S101 mode
A UE supporting S101 mode shall store a list of “forbidden PLMNs for attach in S101 mode”. The UE shall erase this list when the UE is switched off or when the USIM is removed.
In S101 mode, the UE shall add to the “forbidden PLMNs for attach in S101 mode” list the PLMN identity provided with the indication from the lower layers to prepare for an S101 mode to S1 mode handover whenever an ATTACH REJECT message is received with the EMM cause #11 “PLMN not allowed”, #12 “tracking area not allowed”, #13 “roaming not allowed in this tracking area”, #14 “EPS services not allowed in this PLMN”, #15 “no suitable cells in tracking area”, or #35 “Requested service option not authorized in this PLMN” as specified in subclause 5.5.1.2.5.
The maximum number of possible entries in the “forbidden PLMNs for attach in S101 mode” list is implementation dependent, but the list shall accommodate at least one PLMN identity. When the list is full and a new PLMN identity has to be inserted, the UE shall delete the oldest PLMN identity.
5.3.3a Forbidden PLMNs for EPS services
The forbidden PLMNs for EPS services are contained in the “forbidden PLMNs for GPRS service” list, as defined in 3GPP TS 24.008 [13]. The UE updates this list as part of the attach procedure, tracking area updating procedure and network initiated detach procedure as described respectively in subclauses 5.5.1, 5.5.3 and 5.5.2.3.2.
5.3.4 Equivalent PLMNs list
The UE shall store a list of equivalent PLMNs. These PLMNs shall be regarded by the UE as equivalent to each other for PLMN selection and cell selection/re-selection. The same list is used by EMM, GMM and MM.
The UE shall update or delete this list at the end of each attach or combined attach or tracking area updating or combined tracking area updating procedure. The stored list consists of a list of equivalent PLMNs as downloaded by the network plus the PLMN code of the registered PLMN that downloaded the list. When the UE is switched off, it shall keep the stored list so that it can be used for PLMN selection after switch on. The UE shall delete the stored list if the USIM is removed or when the UE attached for emergency bearer services enters the state EMM-DEREGISTERED. The maximum number of possible entries in the stored list is 16.
5.3.5 Handling of the periodic tracking area update timer and mobile reachable timer (S1 mode only)
Periodic tracking area updating is used to periodically notify the availability of the UE to the network. The procedure is controlled in the UE by timer T3412. The value of timer T3412 is sent by the network to the UE in the ATTACH ACCEPT message and can be sent in the TRACKING AREA UPDATE ACCEPT message. The UE shall apply this value in all tracking areas of the list of tracking areas assigned to the UE, until a new value is received.
If timer T3412 received by the UE in an ATTACH ACCEPT or TRACKING AREA UPDATE ACCEPT contains an indication that the timer is deactivated or the timer value is zero, then timer T3412 is deactivated and the UE shall not perform periodic tracking area updating procedure.
Timer T3412 is reset and started with its initial value, when the UE goes from EMM-CONNECTED to EMM-IDLE mode. Timer T3412 is stopped when the UE enters EMM-CONNECTED mode or EMM-DEREGISTERED state.
If the UE is attached for emergency bearer services, and timer T3412 expires, the UE shall not initiate a periodic tracking area updating procedure, but shall locally detach from the network.
When a UE is not attached for emergency bearer services, and timer T3412 expires, the periodic tracking area updating procedure shall be started and the timer shall be set to its initial value for the next start.
If the UE is not attached for emergency bearer services, and is in a state other than EMM-REGISTERED.NORMAL-SERVICE when timer T3412 expires, the periodic tracking area updating procedure is delayed until the UE returns to EMM-REGISTERED.NORMAL-SERVICE.
If ISR is activated, the UE shall keep both timer T3412 and timer T3312. The two separate timers run in the UE for updating MME and SGSN independently. The UE shall start timer T3423, if timer T3412 expires, and timer T3346 is running or the UE is in one of the following states:
- EMM-REGISTERED.NO-CELL-AVAILABLE;
- EMM-REGISTERED.PLMN-SEARCH;
- EMM-REGISTERED.UPDATE-NEEDED; or
- EMM-REGISTERED.LIMITED-SERVICE.
The UE shall initiate the tracking area updating procedure and stop timer T3423 when it enters state EMM-REGISTERED.NORMAL-SERVICE before timer T3423 expires. After expiry of timer T3423 the UE shall set its TIN to “P-TMSI”.
If timer T3423 expires the UE shall memorize that it has to initiate a tracking area updating procedure when it returns to state EMM-REGISTERED.NORMAL-SERVICE.
If the UE is attached to both EPS and non-EPS services, and if timer T3412 expires or timer T3423 expires when the UE is in EMM-REGISTERED.NO-CELL-AVAILABLE state, then the UE shall initiate the combined tracking area updating procedure indicating “combined TA/LA updating with IMSI attach” when the UE returns to EMM-REGISTERED.NORMAL-SERVICE state.
When the network includes T3412 extended value IE in the ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message, the network uses timer T3412 extended value IE as the value of timer T3412.
The network supervises the periodic tracking area updating procedure of the UE by means of the mobile reachable timer.
If the UE is not attached for emergency bearer services or the network has not included the T3324 value IE in the ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message, the mobile reachable timer shall be longer than T3412. In this case, by default, the mobile reachable timer is 4 minutes greater than timer T3412.
NOTE: Timer T3324 is specified in 3GPP TS 24.008 [13].
If ISR is not activated, the network behaviour upon expiry of the mobile reachable timer is network dependent, but typically the network stops sending paging messages to the UE on the first expiry, and may take other appropriate actions.
If the UE is attached for emergency bearer services, the MME shall set the mobile reachable timer with a value equal to timer T3412. When the mobile reachable timer expires, the MME shall locally detach the UE.
If the network includes the T3324 value IE in the ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message, the MME shall set the mobile reachable timer with a value equal to the value of timer T3324.
The mobile reachable timer shall be reset and started with the value as indicated above, when the MME releases the NAS signalling connection for the UE. The mobile reachable timer shall be stopped when a NAS signalling connection is established for the UE.
Upon expiry of the mobile reachable timer the network shall start the implicit detach timer. The value of the implicit detach timer is network dependent. If ISR is activated, the default value of the implicit detach timer is 4 minutes greater than timer T3423. If the network includes the T3324 value IE in the ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message, the value of the implicit detach timer should be 4 minutes greater than the value of timer T3412 and timer T3423. If the implicit detach timer expires before the UE contacts the network, the network shall implicitly detach the UE. If the MME includes timer T3346 in the TRACKING AREA UPDATE REJECT message or the SERVICE REJECT message and timer T3346 is greater than timer T3412, the MME sets the mobile reachable timer and the implicit detach timer such that the sum of the timer values is greater than timer T3346.
The implicit detach timer shall be stopped when a NAS signalling connection is established for the UE.
5.3.6 Handling of timer T3402
The value of timer T3402 can be sent by the network to the UE in the ATTACH ACCEPT message and TRACKING AREA UPDATE ACCEPT message. The UE shall apply this value in all tracking areas of the list of tracking areas assigned to the UE, until a new value is received. The default value of this timer is used in the following cases:
- ATTACH ACCEPT message or TRACKING AREA UPDATE ACCEPT message is received without a value specified;
- the UE does not have a stored value for this timer; or
- a new PLMN which is not in the list of equivalent PLMNs has been entered, the tracking area updating fails and the tracking area updating attempt counter is equal to 5.
The value of timer T3402 can be sent by the network to the UE in the ATTACH REJECT message. If an ATTACH REJECT message including timer T3402 value was received integrity protected, the UE shall apply this value until a new value is received with integrity protection or a new PLMN is selected. Otherwise, the default value of this timer is used.
5.3.7 Handling of the Local Emergency Numbers List
The Local Emergency Numbers List contains additional emergency numbers used by the serving network. The list can be downloaded by the network to the UE at successful registration and subsequent registration updates. There is only one Local Emergency Numbers List in the UE, and it can be updated with EMM procedures if the UE is in S1 mode and with GMM and MM procedures if the UE is in A/Gb or Iu mode.
The UE shall use the stored Local Emergency Numbers List received from the network in addition to the emergency numbers stored on the USIM or user equipment to detect that the number dialled is an emergency number.
NOTE: The user equipment may use the emergency numbers list to assist the end user in determining whether the dialled number is intended for an emergency service or for another destination, e.g. a local directory service. The possible interactions with the end user are implementation specific.
The network may send a Local Emergency Numbers List in the ATTACH ACCEPT or in the TRACKING AREA UPDATE ACCEPT messages, by including the Emergency Number List IE. The user equipment shall store the Local Emergency Numbers List, as provided by the network. The Local Emergency Numbers List stored in the user equipment shall be replaced on each receipt of the Emergency Number List IE.
The emergency number(s) received in the Emergency Number List IE are valid only in networks in the same country as the cell on which this IE is received. If no Local Emergency Numbers List is contained in the ATTACH ACCEPT or in the TRACKING AREA UPDATE ACCEPT message, then the stored Local Emergency Numbers List in the user equipment shall be kept, except if the user equipment has successfully registered to a PLMN in a country different from that of the PLMN that sent the list.
The Local Emergency Numbers List shall be deleted at switch off and removal of the USIM. The user equipment shall be able to store up to ten local emergency numbers received from the network.
5.3.7a Specific requirements for UE configured to use timer T3245
The following requirement applies for an UE that is configured to use timer T3245 (see 3GPP TS 24.368 [15A] or 3GPP TS 31.102 [17]):
When the UE adds a PLMN identity to the “forbidden PLMN list”, the “forbidden PLMNs for attach in S101 mode” list, or the “forbidden PLMNs for GPRS service” list or sets the USIM as invalid for non-EPS services or EPS services or both, and timer T3245 (see 3GPP TS 24.008 [13]) is not running, the UE shall start timer T3245 as specified in 3GPP TS 24.008 [13], subclause 4.1.1.6.
Upon expiry of the timer T3245, the UE shall erase the “forbidden PLMN list”, the “forbidden PLMNs for GPRS service” list, and the “forbidden PLMNs for attach in S101 mode” list and set the USIM to valid for non-EPS and EPS services. When the lists are erased, the UE performs cell selection according to 3GPP TS 36.304 [21].
If the UE is switched off when the timer T3245 is running, the UE shall behave as follows when the UE is switched on:
- let t1 be the time remaining for T3245 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the UE will follow the behaviour as defined in the paragraph above upon expiry of the timer T3245. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.
5.3.8 Abnormal cases in the UE
The following abnormal case can be identified:
a) EMM uplink message transmission failure indication by lower layers
When it is specified in the relevant procedure that it is up to the UE implementation to rerun the ongoing procedure that triggered that procedure, the procedure can typically be re-initiated using a retransmission mechanism of the uplink message (the one that has previously failed to be transmitted) with new sequence number and message authentication code information thus avoiding to restart the whole procedure.
5.3.9 Handling of NAS level mobility management congestion control
The network may detect EMM signalling congestion and perform NAS level mobility management congestion control. NAS level mobility management congestion control consists of general NAS level mobility management congestion control and subscribed APN based congestion control.
Under general overload conditions the network may reject mobility management signalling requests from UEs as specified in 3GPP TS 23.401 [10]. The network should not reject the following requests:
- requests for emergency bearer services;
- requests from UEs that were received via NAS signalling connections established with RRC establishment cause “High priority access AC 11 – 15”; and
- requests for CS fallback emergency call or 1xCS fallback emergency call.
When subscribed APN based mobility management congestion control is active for a particular APN, the network may reject attach requests from UEs with a subscription to this APN.
In mobility management the network may detect NAS signalling congestion and start or stop performing the subscribed APN based congestion control based on mobility management level criteria such as:
- rate of mobility management NAS messages from a group of UEs with a subscription to a particular APN exceeds or falls below certain thresholds; and/or
- setting in network management.
When the NAS level mobility management congestion control is active, the network may include a value for the mobility management backoff timer T3346 in the reject messages. The UE starts the timer T3346 with the value received in the mobility management reject messages. To avoid that large numbers of UEs simultaneously initiate deferred requests, the network should select the value for the timer T3346 for the rejected UEs so that timeouts are not synchronised.
For subscribed APN based congestion control the timer T3346 value for a particular APN may be APN dependent.
If the UE is switched off when the timer T3346 is running, the UE shall behave as follows when the UE is switched on:
- let t1 be the time remaining for T3346 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1; and
- if prior to switch off, timer T3346 was started due to a NAS request message (ATTACH REQUEST, TRACKING AREA UPDATE REQUEST or EXTENDED SERVICE REQUEST) which contained the low priority indicator set to “MS is configured for NAS signalling low priority”, then if timer T3346 is restarted at switch on, the UE configured for dual priority shall handle mobility management requests as indicated in subclauses 5.5.1.2.6, 5.5.3.2.6 and 5.6.1.6.
If the UE enters a new PLMN which is not in the list of equivalent PLMNs, it shall stop timer T3346 when initiating mobility management procedures in the new PLMN.
5.3.10 Access class control
The network can restrict the access for certain groups of UEs by means of barring their access class.
The UE shall evaluate the access control information for Access Class Barring, Access Control for CSFB and Extended Access Barring (EAB) as specified in 3GPP TS 36.331 [22].
5.3.11 Power saving mode
The UE requests the use of power saving mode (PSM) during attach or tracking area updating procedure (see 3GPP TS 23.682 [11A] and 3GPP TS 23.401 [10]). The network accepts the use of PSM by providing a specific timer (T3324) when accepting an attach or tracking area updating procedure. The UE only uses PSM if the network has provided the T3324 value IE during attach, tracking area updating or routing area updating procedures.
NOTE: Timer T3324 is specified in 3GPP TS 24.008 [13].
PSM is activated after every expiry of the timer T3324 if the UE is in EMM-IDLE mode and in the EMM-REGISTERED.NORMAL-SERVICE state. PSM is deactivating by activating the AS layer and initiating tracking area updating or routing area updating procedure. The UE may deactivate PSM at any time e.g. for mobile-originated signalling. When PSM is activated all NAS timers are stopped and associated procedures aborted except for T3412, T3346, T3396 and T3423.
6 Elementary procedures for EPS session management
6.1 Overview
6.2 IP address allocation
6.3 General on elementary ESM procedures
6.4 Network initiated ESM procedures
6.5 UE requested ESM procedures
7 Handling of unknown, unforeseen, and erroneous protocol data
8 Message functional definitions and contents
9 General message format and information elements coding
10 List of system parameters